Live › vulnerability › CVE-2026-105475
cPanel says a flaw in cPanel & WHM v124 and later lets an attacker with no account and no credentials read the calendar entries and contacts of any mail account on the server. NVD attributes it to improper neutralization of a NUL byte. The vendor page does not describe the request path and does not say whether it is exploited.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 21:35 UTC. All times on this page are UTC.
Servers running cPanel & WHM v124 or later that host mail accounts are exposed, and no login is needed to exploit it. VPS and dedicated server owners must update themselves. Shared-hosting customers depend on their provider updating. Servers on a patched build can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| cPanel & WHM | vendor | >= 124, < 134.0.67 (134 track); < 136.0.51 (136 track); < 138.0.19 (138 track) | 134.0.67, 136.0.51, 138.0.19 |
134.0.67, or 136.0.51138.0.19134.0.67, 136.0.51 or 138.0.19 (or later), depending on your release trackEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.
This page as .md · .json · in your agent: get_signal("CVE-2026-105475")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.